BUG/MINOR: jwt: don't take an extra reference on the certificate public key

X509_get_pubkey() already returns an owned reference, so the extra
EVP_PKEY_up_ref() on the cert-store path leaked one reference per
verification, since only one EVP_PKEY_free() is done afterwards. Over
time this means key objects accumulate and are never released, even
across certificate reloads.

Drop the extra reference. The "jwt_cert_tree" path below still needs
its up_ref, since it only holds a borrowed pointer.

Introduced in 3.3 by 522bca98e ("MAJOR: jwt: Allow certificate instead
of public key in jwt_verify converter"). Must be backported to 3.3.

Reported-by: Claude (ANT-2026-PKPCQ3ZN)

diff --git a/src/jwt.c b/src/jwt.c
index 8eb4f063ca9114b67a4a159c8c8feb23ab178527..d10ab1257feccf4966e4b729308ef125543a5d7b 100644 (file)
--- a/src/jwt.c
+++ b/src/jwt.c
@@ -421,9 +421,10 @@ jwt_jwsverify_rsa_ecdsa(const struct jwt_ctx *ctx, struct buffer *decoded_signat
                        store = ckchs_lookup(ctx->key);
                        if (store) {
                                if (store->conf.jwt) {
+                                       /* Note: X509_get_pubkey() already returns an
+                                        * owned reference, don't take another one!
+                                        */
                                        pubkey = X509_get_pubkey(store->data->cert);
-                                       if (pubkey)
-                                               EVP_PKEY_up_ref(pubkey);
                                } else
                                        retval = JWT_VRFY_UNAVAIL_CERT;
                        }